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We spell out details of a simple argument for a security bound for the secure relativistic quantum 
bit commitment protocol of Ref . [IJ . 
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Introduction 

Recently, a new quantum relativistic bit commitment protocol [l| was introduced. Its security relies, essentially, on 
the impossibility of completing a nonlocal measurement on a distributed state outside the joint future light cone of 
its components. Its implementation requires minimal quantum resources: the receiver needs to send quantum states 
(which can be unentangled qubits) to the committer, who needs to carry out individual measurements on them as 
soon as they are received. No further quantum commmunication is required by either party; nor do they require any 
entanglement, collective measurements, or quantum state storage. 

We present the protocol here in an idealized form assuming perfect state preparations, transmissions and measure- 
\ ments. We also make idealizations about the relativistic geometry and signalling speed, supposing that Alice and 
Bob each have agents in secure laboratories infinitesimally separated from the points P, Qo and Qi, Alice can signal 
at precisely light speed, and all information processing is instantaneous. We discuss here the simplest version of the 
scheme using qubit states and measurements in the standard BB84 basis [2|. 

Alice and Bob agree on a space-time point P, a set of coordinates (x,y,z,t) for Minkowski space, with P as the 
origin, and (in the simplest case) two points Qo = {x, 0, 0, x) and Q\ = (—x, 0, 0, x) light-like separated from P. They 
each have agents, separated in secure laboratories, adjacent to each of the points P, Qo, Qi- To simplify for the 
^ \ moment, we take the distances from the labs to the relevant points as negligible. 

Bob securely prepares a set of qubits iV^iLi independently randomly chosen from the BB84 states 
{|0) , |1) , |+) , |-)} (where |±) = -^(|0) ± |1))) and sends them to Alice to arrive (essentially) at P. To commit 
to the bit value 0, Alice measures each state in the {|0) , |1)} basis, and sends the outcomes over secure classical 
channels to her agents at Q and Q\. To commit to 1, Alice measures each state in the {|+) , |— )} basis, and sends 
the outcomes as above. Alice's secure classical channels could, for example, be created by pre-sharing one-time pads 
between her agent at P and those at Qo and Qi and sending pad-encrypted classical signals. If necessary or desired, 
these pads could be periodically replenished by quantum key distribution links between the relevant agents. 

To unveil her committed bit, Alice's agents at Qo and Qi reveal the measurement outcomes to Bob's agents there. 
After comparing the revealed data to check that the declared outcomes on both wings are the same (somewhere in 
' the intersection of the future light cones of Qo and Qi), and that both are consistent with the list of states sent at 
P, Bob accepts the commitment and unveiling as genuine. If the declared outcomes arc different, Bob has detected 
Alice cheating. 

Security The protocol is evidently secure against Bob, who learns nothing about Alice's actions until (if) she 
chooses to unveil the bit. 

Alice is constrained in that she has to be able to reveal her commitment data at both Qo and Qi, since Bob's 
agents at these points verify the timing and location of the unveilings, and then later compare the data to check they 
are consistent. We need to show that, if she is able to do so then, essentially (up to some small probability defined 
in terms of a security parameter) she was committed at P. (See Ref. [3[ for a more formal discussion of security in 
terms of a space-time oracle model.) 

By Minkowski causality, Alice's ability to unveil data consistent with a or 1 commitment at Qo depends only on 
operations she carries out on the line PQo- Suppose that she has a strategy in which she carries out some operations at 
P, but these leave her significantly uncommitted, in the sense that her optimal strategies Si for successfully unveiling 
the bit values i, by carrying out suitable operations in the causal future of P, have success probabilities pi, with 
Po + Pi > 1 + 5, for some S > 0. By Minkowksi causality, any operations she carries out on the half-open line segment 
(P, Qo] cannot affect the probability of producing data at Qi consistent with a successful unveiling of either bit value 
i there. In particular, if she follows the instructions of strategy So on (P, Qo], and the instructions of strategy Si 
on (P, Qi], she has probabilities pi of producing data consistent with a successful unveiling of bit value i at Qi, and 
hence probability at least S of producing data consistent with a successful unveiling of bit value at Qo and with a 
successful unveiling of bit value 1 at Qi. 

This means that, with probability at least 5, by combining her data at Qo and Qi at some point in their joint 
causal future, Alice can produce data consistent with both sets of measurements in complementary bases. Thus, for 
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example, for each state \i(>i), she can identify a subset of 2 states from {|0) , |1) , |+) , |— )}, one from each basis, which 
must include \ipi}- 

Lemma 1. Given a single BB84 state \ip), randomly chosen from the uniform distribution, unknown to her, 
Alice's probability p of choosing one of the subsets Si — {|0) , |+)}, 5*2 = {|+) , S3 = {|1) , |— }}, 54{|— ) , |0)}, 
that includes \4>) , is bounded by p < ^(1 + -^), for any strategy. An optimal strategy which realises this bound is to 
carry out the POVM 

{^1,^2,^3,^4} (1) 

where Pi is the projection onto the qubit \<f>i) = cos(#i) |0) + sin(0j) |1), Oi = i(-7r/4) — (tt/8), and given the outcome 
Pi, she guesses the subset Si. 

Proof. 

Recall first the standard state discrimination problem, in which Bob chooses a state from the set {<5j} with associated 
probabilities {pj}. Alice later makes a measurement to try to determine the state. Her measurement may be described 
by a POVM {%}, where outcome ttj leads her to choose state &j 1 . The probability that Alice identifies the state 
correctly is 

Pcorr = ^PjTr(<7j7r,-) . (2) 
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In the variation here, Bob prepares a random state from the BB84 set. Alice gets two guesses at the state. These 
guesses must be non-orthogonal BB84 states. If either guess is correct, she wins. 
Write the BB84 states as follows 



|ex) = |0) ,|e 2 ) = |+) ,|e 3 ) = |l) ,|e 4 > = |-) . (3) 

We use these states and the corresponding density matrices, fjj = \ej) interchangeably below. Alice makes a 
measurement on the state received, and as a result of the measurement makes her two guesses. Alice's possible 
guesses are Si — {\ei) , |e 2 +i)} for i = 1 to 4. Here and below we use the convention that lei+4) = \ef) and similarly 
for pi and 7^. Each possible guess should correspond to a measurement outcome, so we can associate each guess 
{|ei) , |ei+i)} with a POVM element iti (some of which might in principle be zero). Now the probability that Alice 
wins is the average over i of the probability that Alice chooses a set containing pi, weighted by the probability that 
state f>i was prepared. Explicitly we obtain: 

P(win) = 1^ +*,_!)) (4) 

i 

= \^{\{f>l +Pi+l)Ki)). 

Thus the problem is equivalent, up to a factor of 2, to that of discriminating between the set of equiprobable states 
{§ {p% + Pi+i)}- Maximising the probability that Alice wins is equivalent to minimising the probability of error in 
discriminating these states. 

A necessary and sufficient condition on a POVM realising a minimum error measurement distinguishing general 
normalised states aj chosen with probabilities pj is given by 

f- Pj aj>0 Vj, (5) 

where 

f = ^ j PiO i ^i (6) 

i 

and P corr = Tr(r). 



Note that the number of outcomes does not have to equal the number of states prepared - in the general case there may not be a POVM 
element for every j. 
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For our transformed state discrimination problem we must calculate the operator 

1 4 1 1 

i=l *~ 

and show that 



f-ipi-gPi+i>0, for i = 1,2,3,4. (8) 
It is straight-forward to verify that the POVM (fT]) satisfies this condition. For this set 

f = i(l + ^)f. (9) 
Allowing for the factor of 2 above, we obtain Alice's optimal guessing probability for the original problem as 

P win = 2Tr(f) = l(l + -^). QED (10) 

Lemma 2. Suppose now Alice is given a sequence of i.i.d. BB84 states \^i)^ = i, randomly chosen from the uniform 
distribution, and unknown to her, and is allowed to perform a strategy S involving arbitrary collective operations. Let 
Pii,...,ij V _ 1 ;ji,...,j w _i be her probability of choosing a subset from the list S\ = {|0) , |+)}, S% = {|+) , |1)}, S3 = 
{|1) , |— )}, S4 = {|— ) , |0)}, that includes the BB84 state l^jv); conditioned on the first (N — 1) states supplied being 
\ei t ) , . . . , |ei JV _ 1 ) and her guesses being Si, . . . , Sj N _ ± respectively, where the strategy S implies this is a possible list of 
guesses for the inputs. Then Pi 1 ,...,i N _ 1 -,j 1 ,...,j N _ 1 < |(1 + -^j), for any strategy S and any {ii, . . . , ijv— x'ijx ■ ■ -iiv-i} 
consistent with S . 

Proof. 

Suppose some collective strategy S violated this bound for some values . . . ,ijv_ ■ ■ • iJn-i}- Alice could 
then proceed as follows. 

1. Prepare an entangled singlet state of two qubits, 

2. Prepare (N - 1) BB84 states (e^) , . . . , \e iN _ 1 ). 

3. Apply strategy S (ignoring her knowledge of the BB84 states prepared) to the (N — 1) BB84 states and one 
qubit of the entangled states, 

4. For the first (N — 1) states, check the guesses produced by S, 

5. If the results do not agree with {Sj 1 , . . . , Sj N _ 1 }, return to step 1 with a new singlet and a new batch of BB84 
states. If they do agree, proceed to step 6. 

6. Apply a teleportation operation on the unknown BB84 state IV'jv) and the other singlet qubit, obtaining tele- 
portation unitary U. Complete the implementation of strategy S, obtaining a guess at a subset containing the 
teleported unknown qubit U \iI>n)- Apply the inverse {/' to obtain a guess at a subset S^ containing IV'at)- By 
assumption, this guess is correct with probability Pi lt ...,i N _ 1 -,j ll ... t j N _ 1 > ^(1 + -^j). 

This iterated strategy is bound to proceed to step 6 eventually, and I^jv) is left isolated until step 6 is reached. 
Alice thus has a strategy that produces a subset guess for any single unknown state \iPn), with success probability 
p > |(1 + -^=), contradicting Lemma 1. QED 

Theorem 1. Alice's probability pjq of being able to produce data consistent with measurements in complementary 
BB84 bases for N random uniformly i.i.d. unknown BB84 states obeys p^ < (i(l + -^)) N ■ Hence, the security 

parameter S in the bit commitment protocol above obeys S < (^(1 + ~^q)) N ■ 

Proof, follows from Lemma 2. 

Note that this argument easily extends to give security bounds for large N in the presence of noise and errors, so 
long as the total noise and error rate is below (i — ■^j^)- To see this let Zi = Y^k=\ 3k — I ^(1 + A=), where jk = 1 if 
Alice's subset guess on the k-th state is correct and jk = otherwise. We have \Zi\ < 00, \Z\ — < \{1 + 
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and (from Lemma 2) E(Zi\Wk) < Z^ for all I > k, where Wk is the set of subset guess outcomes up to state k. So Zi 
is a supermartingale and the Azuma-Hocffding inequality implies 




for any e > 0. 

Notes 1. After the work reported above was completed, an independent security analysis following different 
arguments was circulated by Kaniewski et al. 0j- 

2. An alternative proof of Lemmas 1 and 2 and Theorem 1 follows by noting that for any collective guessing strategy 
of Alice's, any particular subset guess Si for the iV-th state, conditioned on input states je^) , . . . , |ej JV _ 1 ) and guesses 
{Sj 1 , . . . , Sj N _ 1 } for the first (N — 1) guessing games, must be represented by some positive operator A = A> > on 
the iV-th state. Since the states are i.i.d. and uniformly distributed, the probability this guess is correct is 



Tr(A(\(p i + pf +1 )))/(±Tr(A)), (12) 

which is easily seen to be bounded by ^(1 + 7^)1 for any value of i. That is, Alice's maximum confidence quantum 
measurement [8( on the iV-th state is unaltered if she carries out collective measurements. 

Moreover, this implies a further security result. Alice's maximum confidence measurement on the iV-th state cannot 
improve on this success bound even if her strategy allows her sometimes to make no guess on some states (possibly 
including the iV-th). Hence the protocol remains secure for large N in the presence of any loss level (as reported by 
Alice) below 1. That is, it remains secure even if Alice is allowed to report a large fraction of her measurements as 
giving no result, so long as she tells Bob at (essentially) the point P which measurements were successful. 

3. Another proof of Theorem 1 is given by verifying that a minimum error measurement for N BB84 states is 
obtained by taking the iV-fold tensor product of the POVM (p}. This follows straightforwardly using the method 
given above for N = 1. 
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